#1075747 curl: X.509 client certificates not working with curl/8.8.0-2

Package:
curl
Source:
curl
Description:
command line tool for transferring data with URL syntax
Submitter:
Jan Schlien
Date:
2024-07-07 20:30:03 UTC
Severity:
normal
#1075747#5
Date:
2024-07-04 08:48:17 UTC
From:
To:
/usr/bin/curl --cert <cert> --key <key> <url> no longer works with the version
mentioned above. It worked well with the previous version 8.8.0-1. The error
message is:

    curl: (35) error reading X.509 key or certificate file

From the changelog, this bullet point comes to mind:

    * Switch curl package/binary to use gnutls, now with HTTP3 support

Looking at strace output, curl does read a lot of certs from /etc/ssl/certs/
(not shown) but it not attempt to read the path given with --cert. It reads the
--key file and then does a bogus sendmsg():

After that, it prints the error message one character by one and exits. Let me
know if anything else is needed.

Thanks,
Jan
#1075747#10
Date:
2024-07-04 09:20:27 UTC
From:
To:
On Thu, 4 Jul 2024, Jan Schlien wrote:

curl upstream has fixed a few x509asn.1 bugs since 8.8.0 that will be included
in the pending 8.9.0 release that ships in three weeks.

I believe this specific bug is fixed by this commit:

https://github.com/curl/curl/commit/9aa1d412b814a40868558da51a6ab28ce1384a58

  / Daniel
#1075747#15
Date:
2024-07-04 09:20:27 UTC
From:
To:
On Thu, 4 Jul 2024, Jan Schlien wrote:

curl upstream has fixed a few x509asn.1 bugs since 8.8.0 that will be included
in the pending 8.9.0 release that ships in three weeks.

I believe this specific bug is fixed by this commit:

https://github.com/curl/curl/commit/9aa1d412b814a40868558da51a6ab28ce1384a58

  / Daniel
#1075747#20
Date:
2024-07-04 23:47:21 UTC
From:
To:
Hi Jan,

Could you provide an example so we can make sure the fix is actually
fixing this problem?

Just a way to reproduce the issue. We are going to import the patch
pointed out by Daniel and we want to make sure it fixes your problem.

Cheers,
Charles
#1075747#25
Date:
2024-07-07 09:43:58 UTC
From:
To:
Hi Charles,

Unfortunately no. I tried various client certificates for testing
purposes, but all of the artificially created certs are working as
expected. The one I am experiencing problems with has quite a bunch of
X509v3 extensions listed, I guess that might have impact, but I couldn't
manage to create one that looks exactly like the one I am using.

I am happy to build curl myself, add the proposed fix and test the
result if you could show me to the right starting point for the sources.
#1075747#30
Date:
2024-07-07 15:03:33 UTC
From:
To:
Hi,

Without a reproducible way to see the bug happening, it'll very
difficult to get a fix. But...

We have uploaded 8.8.0-3 yesterday with the possible fix pointed by
Daniel. Please test it and let us know if it really fixes your problem.

Cheers,
Charles
#1075747#35
Date:
2024-07-07 20:26:11 UTC
From:
To:
Hey Charles,

Understood, so...

As it does not fix the issue I'm seeing, I will try harder to provide a
reproducer and come back.

Thanks a lot for the support!
-Jan